Mozilla Firefox Version 101.0 Released with Security Updates

             Mozilla sent Firefox Version 101.0 to the release channel today.  The update includes eleven security updates of which seven (7) are rated high, four (4) moderate and one (1) are rated low.

Firefox ESR was updated to Version 91.10.

High

• #CVE-2022-31736: Cross-Origin resource's length leaked
• #CVE-2022-31737: Heap buffer overflow in WebGL
• #CVE-2022-31739: Attacker-influenced path traversal when saving downloaded files
• #CVE-2022-31740: Register allocation problem in WASM on arm64
• #CVE-2022-31741: Uninitialized variable leads to invalid memory read
• #CVE-2022-31747: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
• #CVE-2022-31748: Memory safety bugs fixed in Firefox 101

 Moderate

• #CVE-2022-31742: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information
• #CVE-2022-31743: HTML Parsing incorrectly ended HTML comments prematurely
• #CVE-2022-31744: CSP bypass enabling stylesheet injection
• #CVE-2022-31745: Incorrect Assertion caused by unoptimized array shift operations

Low

• #CVE-2022-1919: Memory Corruption when manipulating webp images

#

New

• Reading is now easier with the prefers-contrast media query, which allows sites to detect if the user has requested that web content is presented with a higher (or lower) contrast.

• It’s your choice! All non-configured MIME types can now be assigned a custom action upon download completion.

• Firefox now allows users to use as many microphones as you want, at the same time, during video conferencing. The most exciting benefit is that you can easily switch your microphones at any time (if your conferencing service provider enables this flexibility).

Update: To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Security Updates
• Release Notes
• Rapid Release Calendar